Environments
Keepable has two data planes (sandbox and live) selected entirely by your API key's prefix. There are no separate hostnames or accounts to manage; you switch environments by switching keys.
Keepable runs two isolated data planes behind one API:
- Sandbox: synthetic data, mocked side-effects, free. Keys are
kpk_test_. - Live: real recipients, real seals, billed. Keys are
kpk_live_.
The plane is chosen by the key prefix, nothing else. The base URL, the endpoints, and the request shapes are identical. To switch environments, switch the key you send.
# Sandbox
curl https://api.keepable.co/sender/wallet -H "Authorization: Bearer kpk_test_..."
# Live
curl https://api.keepable.co/sender/wallet -H "Authorization: Bearer kpk_live_..."Confirm which plane you're on
Every response your credential produces is bound to a plane. The cheapest check
is whoami, which echoes the mode:
curl https://api.keepable.co/sender/whoami \
-H "Authorization: Bearer $KEEPABLE_TOKEN" \
-H "Keepable-Version: 2026-05-24"{ "kind": "sender", "id": "ten_01HXP", "scopes": ["content.write"], "mode": "sandbox" }Treat mode as a guardrail in your own code: before a job that sends real mail,
assert mode == "live"; before a test run, assert mode == "sandbox". A
misplaced key is then a loud failure, not a silent live send.
What isolation guarantees
The two planes never share data. A kpk_test_ credential is physically confined
to the sandbox schema-set, so a sandbox call can never read or write a live
record (and the reverse holds for live keys). The routing fails closed to live:
a request with no explicit sandbox credential always targets the live plane.
Because a sandbox tenant and a live tenant are provisioned independently, your
sandbox tenant_id and your live tenant_id may differ. Address recipients and
resources by the ids returned within the plane you're calling.
A typical path
- Sign up for a sandbox key and build your integration.
- Drive success and failure branches with the magic test data.
- When it works end to end, complete going live.
- Swap the
kpk_test_key for yourkpk_live_key in production config; no other code changes.
Going live
Moving from the sandbox to production means clearing three gates (an approved KYB, an accepted Sender Agreement, and a funded prepaid wallet) before you can mint a live key.
Tenants
A tenant is your organisation inside Keepable, the entity that owns content, agreements, forms, and branding. Create and manage tenants, attach TINs, and set the icon recipients see.